For the first adversarial scenario, we hand selected five frames from each session and cropped the images to the key face region. We split these frames into query and reference datasets consisting of two and three frames per subject, respectively. The recognition accuracy at different levels of K is shown as dotted lines in Figure REF  (N=22). We augment the test set by adding more identities as the reference databases in the defined threat scenario would typically be much larger than our 22 identities. We include additional identities, children aged 5-15, procured from the IMDB-Face dataset [1]}. Recognition accuracy is shown as dashed lines (N=44) and solid lines (N=216). In all cases, the face swapping approach reduces recognition accuracy relative to the original faces. The powerful blur rendered the faces undetectable, yielding a 0% recognition rate.
